The tarball for auditbeat on macOS does not include the plist file needed for launchd. There's a older thread that outlines setting up filebeat on macOS. The manual process should be pretty similar for auditbeat.

Hi all,
I am looking into deploying filebeat on Mac OS X (10.11). The package does not contain the wrapper binary filebeat-god, so the question is how to daemonize filebeat properly.
Starting it manually I can use "./filebeat -e -c filebeat.yml &" to dispatch ist from my shell, but for handing it over to launchd that would be poor.
Anyone out there already using it on MacOS X?
Any hint or help is appreciated.
Dirk

Additionally, you could review the brew forumla for auditbeat to find which steps are needed to manually create the needed plist file for auditbeat.